A Constitutional Challenge to Alaska’s Genetic Privacy Statute

As part of its defense of a class action lawsuit that began in 2014, a genetic genealogy company (or DNA ancestry company as they are sometimes called) is challenging the constitutionality of the Alaska Genetic Privacy Act, arguing that the statute’s provisions are unconstitutionally vague. The State of Alaska is intervening in the lawsuit to defend the statute.

The Alaska Genetic Privacy Act (AK ST §18.13.010 et seq.) was passed into law in 2004. The state statute imposes a consent requirement that effectively prohibits surreptitious genetic testing and declares that a DNA sample and the results of any genomic analysis are the “exclusive property of the person sampled or analyzed.” More specifically, it requires prior written informed consent for the collection, analysis, retention, or disclosure of DNA samples and test results. The statute makes exceptions to the consent requirement for DNA identification registries like CODIS, law enforcement purposes, paternity testing, newborn screening, and emergency medical services. There are both civil and criminal enforcement mechanisms in the statute. Affected individuals can bring private civil court actions against violators of the statute (AK ST §18.13.020), while another provision criminalizes violations as Class A Misdemeanors (AK ST §18.13.030). The statute (AK ST §18.13.020) provides that a victim is entitled to compensation from the violator in the amount of $5,000 or, in instances in which the violation “resulted in profit or monetary gain to the violator,” $100,000.

A putative class action lawsuit (that is, it has been filed as a class action but not yet certified by the court) known as Cole v. Gene by Gene, LTD, was filed in federal district court in Alaska in May 2014 against Gene by Gene, LTD, a Texas-based company doing business as Family Tree DNA or FTDNA. The named plaintiff (the person named in the suit, who claims to represent many other similarly situated people) alleges that the company published his genetic information online without his consent. The defendant argues in its defensive pleadings that “a six-figure damages scheme” prompted “buyer’s remorse.” An insurance coverage dispute quickly ensued between Evanston Insurance Company and Gene by Gene. That matter was resolved in January 2016 by a federal district court in Houston, Texas, which ruled that the insurance company did have a duty to defend and indemnify Gene by Gene in the underlying class action suit. As the underlying class action litigation moved forward, Gene by Gene filed separate motions in an effort to dispose of the case—the first a motion to dismiss filed in September 2016 and the second a motion for summary judgment filed in November 2016. The motion to dismiss was based on the federal constitutional doctrine of standing, explained below. The motion for summary judgment asserts that because the plaintiff’s claim is based on damages set by statute and that statute is, Gene by Gene argues, unconstitutional, the plaintiff’s claim lacks a legally sufficient theory of damages and thus cannot proceed.

In April 2017, Gene by Gene filed a notice to the court and the Alaska Attorney General that it is challenging the constitutionality of the Alaska Genetic Privacy Act, asserting that the statute is unconstitutionally vague in its definitions of “DNA analysis” and “genetic characteristics” and in its failure to define “disclose” and “informed and written consent.” The company argues that the statute is not specific enough to allow reasonable people (including the company as the defendant in this case) to know what behavior would run afoul of the law. The State of Alaska sought approval to intervene in the case to defend the statute’s validity, which the Alaska federal court granted on June 23, 2017.

Most recently, on June 30, 2017, federal District Judge Sharon L. Gleason denied Gene by Gene’s motion to dismiss for lack of standing. According to the standard set by the U.S. Supreme Court in Spokeo, Inc. v Robbins, 136 S. Ct. 1540, 1549 (2016), plaintiffs who allege that the defendant violated a federal statute must still claim to have suffered a concrete injury-in-fact (beyond experiencing “bare procedural violations”) in order to have standing to sue. The question of whether state statutes can confer standing on plaintiffs who have not suffered concrete injury has not been decided consistently post-Spokeo. Here, the court ruled that the state statute did not merely set procedural requirements but recognized a substantive right in one’s genomic information; accordingly, the alleged unauthorized disclosure of DNA results is a concrete injury-in-fact sufficient for standing.

This case in Alaska is likely to have interesting implications for the personal genomics industry and for the fate of genetic privacy laws in other states. One aspect to watch is how this case addresses the intersection of online consumer contracts and “informed consent” norms for research. It is unclear how contractual rules governing terms of services in consumer transactions should be reconciled with federal rules governing research, although presumably the latter should inform the former. Moreover, the research rules are expected to change in 2018 if the Trump administration’s regulatory freeze is ever lifted. The freeze issued on January 20, 2017, prevented regulations from taking effect if they had not yet done so. Long-awaited but controversial reforms to the Common Rule (the federal policy to protect participants in research) that would, among other things, usher in new rules for process and documentation of informed consent for genomic research (allowing broad consent for genomics but specifying how and what information about the scope, benefits, and risks of participation must be displayed in the consent document) were published in the Federal Register the day before the regulatory freeze was issued and were scheduled to take effect on January 19, 2018. The fate of the 2018 Common Rule remains uncertain, and it is also unclear how the January 30, 2017 Executive Order demanding that “for every one new regulation issued, at least two prior regulations be identified for elimination” will apply to the frozen regulatory reforms.

Another aspect to watch is the public’s reaction to an ultimate decision on the statute’s constitutionality. Reports suggest that individuals are growing increasingly concerned about their genetic privacy, anecdotes suggest that it is becoming increasingly difficult to alleviate concerns and confusion research participants have in the midst of health care law uncertainty, and experts are busy highlighting how health care reform bills could undermine genetic privacy. Ultimately, the outcome of this case could motivate activists seeking stronger genetic privacy protections across the United States. It also could prompt DNA ancestry companies and their enthusiasts to seek changes to existing privacy laws to make exception for their practices.